Privacy Policy

AI Mindset Applied Studio · Effective date: October 20, 2026 · Operated by AI Mindset LLC ("AI Mindset", "we", "us")

1. Our privacy approach

The applied studio (“Studio”) is engineered so that we hold as little data as possible. There are no individual user accounts, no login identities, and no server-side database of anything you type. We don’t claim any ownership over your organization profiles, tool inputs, and generated output, which live on your device. Because we do not collect or control this content, you retain all ownership and control of your inputs and outputs at all times.

This privacy policy (“Policy”) explains precisely what stays on your device, what transits our systems when you use an AI feature, and the records we keep to operate company-level access.

2. Where your work is stored

Everything you enter into the Studio - your organization profile, tool inputs (for example in the Disruption Compass, Task Force Charter, or Role Blueprint), and the outputs the Studio generates - is stored exclusively in your browser's local storage (localStorage) on your device, except as set out in Section 4.

• No central database. We do not operate a backend database of user session content. AI Mindset employees do not view, access, or restore your inputs or outputs.
• Device- and browser-specific. Your work does not follow you to another browser or device unless you export it yourself.
• You control deletion. Clearing your browser data erases your Studio work entirely (see Section 8). Using a private or incognito windows discard all your Studio work when the window closes.

3. The information we collect

Access to the Studio is granted per client organization through a shared access code. To operate this, we maintain a record per client in our infrastructure (Cloudflare Workers KV), comprising:

• a one-way cryptographic hash (SHA-256) of the organization's access code, used to verify unlock attempts;
• an encrypted copy of the access code, enabling us to reissue it to the client organization's administrator if it is mislaid;
• the organization's name; and
• an active/inactive flag, allowing a code to be deactivated without affecting other clients.

This record contains no personal information about any individual, and nothing any user inputs into the Studio. When you enter an access code, it is transmitted to our verification endpoint, hashed, and checked; your browser then retains the hash and your organization's name locally, and our server sets a signed access cookie in your browser (valid for 30 days) that identifies your organization, not you, so that you are not asked again on that device.

We implement reasonable administrative, technical, and organizational safeguards designed to protect the information we maintain against unauthorized access, use and disclosure.

While no method of transmission or storage can be guaranteed to be completely secure, we take commercially reasonable measures to protect the information under our control. If you become aware of a security vulnerability or suspect unauthorized access to the Studio, please contact us immediately using the contact information provided in Section 12.

4. AI processing

The Studio's generative features (including the Navigator) are powered by third-party large language models via Anthropic's Claude API, accessed through our own server-side relay.

• The path your input takes: when you use an AI feature, the relevant input is sent from your browser to our relay endpoint (on the same domain), which attaches our API credentials and forwards the request to Anthropic's API. The response is returned along the same path.
• Transient processing: our relay does not log, store, or archive prompts or responses. The content transmitted is used solely to generate the immediate response.
• No model training: under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models.
• Anthropic's retention: Subject to any exceptions set out in Anthropic's commercial terms and data policies, Anthropic retains API data for up to 30 days, during which the data may be accessed for trust-and-safety monitoring purposes, and thereafter deletes it, as governed by its commercial terms and data policies, available at anthropic.com/legal/commercial-terms. This processing may take place on servers located outside your country of residence, including in the United States.
• Usage attribution: AI requests carry your organization's access-code hash so that aggregate usage (request counts and token volume) can be attributed per client at the client-organization level for capacity and billing purposes. This attribution is at the organization level, not the individual level.

5. Hosting and infrastructure

The Studio is served by Cloudflare, Inc. (“Cloudflare”). As with any website host, Cloudflare maintains standard operational logs (such as IP addresses, timestamps, and URLs requested) as part of operating and protecting the service. This data constitutes infrastructure-level metadata processed by Cloudflare under its own privacy policy; such data is not retained by AI Mindset.

6. Cookies, analytics, and trackers

• The Studio does not employ any analytics, or telemetry scripts, third-party trackers or advertising technology.
• The Studio does not set any tracking cookies. The only cookie the Studio sets is the signed access cookie described in Section 3, which identifies your organization, not you. The Studio uses browser local storage solely to retain your own work and your device's access state.
• No third-party content is loaded on the page: fonts and scripts are self-hosted, so pages load only from our domain.

7. Guidance for regulated industries

Many Studio clients operate in regulated sectors. Your work is stored locally and we retain no server-side copy, — but what you choose to input may be governed by your own organization's data-handling policies.

8. Deleting your data

• Your work: To permanently delete your Studio work, the user must clear the website data associated with the Studio through the browser settings or otherwise clear the applicable browsing data. We hold no copy to delete on our side.
• Your organization's access record: upon termination or expiration of the client relationship, the access record described in Section 3 will be deactivated and deleted, without prejudice to Anthropic's retention of data as described in Section 4. You or your organization's administrator may request deletion of this record at any time by submitting a request using the contact information set forth in Section 12, subject to any legal, regulatory, or legitimate business record-retention obligations.

9. Your rights

Subject to applicable data protection laws, and taking into account the limited nature of the personal information we maintain as described in Section 3, you may have certain rights regarding your personal information, where applicable. To exercise any such rights, please contact us using the details provided in Section 12. We will respond to your request in accordance with applicable law.

10. Legal disclosures

We may disclose information we collect if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law or governmental request; or (b) protect the rights, property, or safety of AI Mindset, our customers, or the public, as permitted or required by law.

11. Children's privacy

The Studio is intended for business use by adult professionals and is not directed at children. We do not knowingly collect personal information from children, and the Studio should not be used by anyone under the age of 18.

12. Changes and contact

If we change how the Studio handles data, we will update this Policy and revise the effective date above. Material changes will be communicated to client organizations directly.

For questions or requests relating to this Policy, please contact us at: studio@ai-mindset.com